Best Free Adware/Spyware/Scumware Remover
|
In a Hurry?
|
|
Introduction
|
|
It's been some time since my last round of testing, and the time has certainly come for a refresher. Adopting much the same approach as previously, I have been asked if there were any surprises, and the honest answer is yes, there have. The most significant surprise was how difficult I was finding it to infect my system in the first place. After three hours of browsing, deliberatley choosing websites and domains where infection was almost a prerequisite, I had nothing, and it was only after investigating various system settings that I found out why. For those looking for the technical "how I did it", I once again started with a clean install of XP SP2 on a virtual machine, patched with the necessary microsoft updates. I deliberately did not upgrade to SP3. Having gotten my clean install, I backed it up, and then went off to infect it. Before doing so I downloaded installation packages for those on test, and once I had my machine infected, I backed up the infected machine. I restored the original infected machine to test each product, ensuring a level playing field for each test. Finally, I did incremental scans with each product on the same infected system. |
|
Discussion
|
|
So, the question is why was it so hard for me to get my machine infected in the first place, and having identified the "problem", my top recommendation is not an anti-malware product, and doesn't even involve a download or a scan of any type. It doesn't offer any form of protection on your PC, but it will help enormously against infection in the first place. What is this magic solution? For some time, I have been using OpenDNS as my DNS server, rather than my ISPs own offering. I hadn't realised how pro-active OpenDNS is in the fight against drive by malware protection. Quite simply, every time I tried to visit a site guaranteed to infect me, it was simply shown as not found. During normal browsing sessions you never see this, and so it took me a while to realise the cause. Only after switching back to my ISP hosted DNS was I able to find the infections that I craved. Requiring only a quick, free registration and simple confirguration change, you improve your protections considerably. Having made that recommendation, it is still possible to infect your system, either running software that may spread infection, or visiting sites that may not be in OpenDNS blacklist, and whilst an excellent first line of defence, local protection is still a must. Top of the list once again is SuperAntiSpyware, which successfully detected and cleaned 121 threats on my test system. A fairly lightweight download and simple installation (5.99 MB) mean that this is not a burdensome product. If anything, the general package, whilst aesthetically similar, is improved since last time, managing to detect and clean after a single scan rather than the two scans required last time. A reboot to complete cleaning was still required, though this is a minor inconvenience, and required by most packages. If I had to raise a critisicm, it's that the freeware version still installs a startup item which doesn't actually do anything at all. In the paid version, it loads the always on protection which is not available in the freeware version. This minor annoyance aside, it remains my top recommendation.
Promoted this time to joint second place is A-Squared free edition, and let me be very clear that it is ONLY the free edition that I am able to recommend. A-Squared was able to identify just 43 infections, though some of the more serious threats identified by SAS were included in these. If we disregard tracking cookies, then the margins narrow. However, detection rate is only half the battle, and unfortunately A-Squared was unable to automatically clean some of the more virulent infections found itself. Nevertheless, it helpfully provides a link to forums for manual removal instructions.
The downside of A2 is the download size, being a huge 54.2 MB, immediately followed by a further 20MB updates. Anyone on restricted bandwidth or dial up may be advised to look elsewhere, but for an average broadband connection this should not be a factor.
As mentioned, I can only recommend the freeware version. During testing I inadvertently downloaded the full version of A2, which runs in evaluation mode for 30 days. Strangely, the full version hung on the scan during each test (though the program itself didn't crash), which is a particular worry.
Sharing the second place spot is MalwareBytes AntiMalware. MBAM caused me considerable problems initially, being one of two programs that had been actively bocked from running by one of the nasties I had picked up. Only after renaming the main executable, and running it in safe mode was I able to proceed. This initial scan found 19 infections and managed to clean them sufficently that when I rebooted I was able to run the program in a normal environment. I updated the program and ran a full scan, which found a further 8 infections, bringing the total to 27. Where MBAM did better than other products on test was it's ability to remove hijacked DNS entries (which forced redirection of links from popular search engines to less productive sites).
Separating A2 and MBAM is almost impossible. I found them to be on a par with each other regarding their scans, but both require a technical proficiency that many may not posses; A2 requires manual removal of many threats, whilst MBAM forced me to jump through hoops to get it working.
PCTools SpywareDoctor SE also performed well in scanning, finding 24 threats (excluding cookies). Unfortunately, cleaning the system proved more problematic. Despite reporting successful cleansing, SD failed to terminate processes already running, and did not in fact clean some of the more annoying infections. It would also be useful if SD prompted a reboot after cleansing, though it did not do this, and only experience dictated that this would be a good idea.
SD does, however, include real time protection, which most other products don't, and this protection did block those infections that it had failed to clean. Nevertheless, a further scan and clean with SAS was needed to fully clean my test system. A fine effort, but sadly falling short of the mark. Do note that the free version is no longer available from the PCTools website. It can be obtained as part of the google pack, or from here.
Old timer Ad-Aware, coming in at 35.7MB performed reasonably, if not exceptionally, finding a further 24 infections even after cleaning with A-squared, 4 of which represented real threats, whilst the remaining 20 were cookies.
Doing less well in on demand tests were Spybot S&D, Spyware Terminator and The Cleaner 2010. Spybot was the other program that was actively blocked from running, and nothing I tried could overcome this. It does come with an on demand file scanner which can be run from the command line and set to scan your entire drive. However, after letting this run for over an hour and noting that progress had barely touched my relatively small installation system (2.1 Gb) I cancelled. It would take an age to complete the scan, and would only examine files. Registry entries and services would be left untouched. Spyware Terminator found just 3 threats, and The Cleaner 2010 found absolutely none.
Arovax Shield is still in development, and starting to mature, though there are still bugs to be ironed out. For example, once installed, and after the obligatory reboot to enable it to start it's services, it immediately complained that it could not find Firefox. This is no surprise since FF was not installed on the test system, though I fail to see why it should prevent it from doing it's job. Maybe as time progresses this will become more viable, but in my opinion it isn't quite there yet.
And so that leads us to my standard "other recommendations". Internet Explorer has now reached version 8, which I am sure will become the most prolific web browser before too long, and as such will be the most heavily targetted. I stand by previous recommendations that an alternative browser (of which there are many free ones these days, including Firefox, Opera, Google Chrome and Safari) will offer a safer browsing experience.
And in order to shut the door after the horse has bolted, there is still little more useful that HiJack This, which is still a tool requiring expert help, but can be invaluable in helping to clean an infected system. Fortunately, the expert help is still only a forum away.
And as always, let common sense guide you. Don't run a program from an untrusted source, and don't visit websites where infection is likely. You should also beware of popups from programs that you haven't installed, some of the fake anti-spyware I managed to pick up in my browsing sessions was surprisingly convincing. Remember, sometimes malware will scream into your face that it is there (see pic, not a genuine window amongst them). It will just not tell you what it really is.
|
|
Related Products and Links
|
|
|||||||||||||||||||||
|
|||||||||||||||||||||
|
|||||||||||||||||||||
|
|||||||||||||||||||||
|
|||||||||||||||||||||
|
|||||||||||||||||||||
|
This software category is maintained by volunteer editor Steve Hargreaves. The comments section below is so lengthy that it has become difficult for our visitors to read. Future posts will now be edited for length and repetition, and personal attacks deleted. You are all welcome to join our Security Forum which is much better-suited for intensive debate ... peter |
|||||||||||||||||||||
Delicious
Digg
StumbleUpon
Please rate this article


Subscribe to our 

Hello. I just wanted to report this antimalware test made by malware research group, here: http://malwareresearchgroup.com/?page_id=2
Malwarebytes scored a perfect score (I think they used the full version), but they let SuperAntispyware stay out.
Please be very cautious as to what you believe from the Malware Research Group. Some question their ethics and/or methods. For more information, please see this link at Wilders:
http://www.wilderssecurity.com/showthread.php?t=251113
I have nothing vested in whether or whether not they are a legitimate, professional, testing organization. I just think it important to bring concerns to people's attention.
I just had a question regarding HijackThis. Since many experts use the logs generated by that program to clean infected systems, I was wondering whether that program is outdated because it isn't regularly updated. According to one website (geekstogo), they use another program called OTListIt2 or OTL to create logs instead of HijackThis. Is that program good? How does well does it work compared to HijackThis? (just looking for more opinions on this program) Thanks ahead!
Steve has given a good reply.
I would like to add that a new version of HiJackThis is under development. The beta version can be found on download sites. Final version will come soon.
I've only tested HiJack this in this category of program up to now, though I intend to try others. However, the nature of the program is such that updates are largely irrelevant. It isn't a malware scanner, but more a process reporting tool. It still requires someone with knowledge to interpret the results and determine the action to take,
For this reason, a lack of updates is not a reason to abandon the tool. It's as useful now as it was when first released.
Steve
Thanks for the reply and explanation! I read on geekstogo that some malware has changed to hide partly/completely from HijackThis scans. Since that is only one website, I am not sure whether that statement is valid or not. I hope that if OTL turns out to be a good program it can be added to this site. I love the advice/information given on this site! Keep up the good work! :D
you can kill the "Prevented from running" issue by re-naming the HiJackThis executable to something else - for example - call it zkr.exe.
This is a known problem - and renaming fixes it.
No software is immune from this kind of hiding, though only apply the fix where you know it won't interfere with the running of the program (HJT works fine with another name) - or at the very least - remember what you changed.
Steve
"How to Stop 11 Hidden Security Threats"
You can read the entire article, here:
http://www.pcworld.com/article/187199/how_to_stop_11_hidden_security_thr...
Excerpt:
"Read on for descriptions of 11 of the most recent and most malignant security threats, as well as our complete advice on how to halt them in their tracks."
Wolfram
I am very suprised with such low score for A-Squared - it is a bit strange that in test included in article A-Squared loses with SAS but in test ran by for example malwareresearchgroup.com or mylovelyapps.com (link in post below) it's exactly opposite.
Is any chance for comment from article's author? Thanks in advance!
Happily.
In order to test I create a clean VM, and then browse the less salubrious parts of the internet in order to pick up infections that anyone may find in the wild. I then copy the VM and begin testing, restoring the VM after each test to ensure a fair comparison.
The fact of the matter is, in my last round of tests, A-Squared was quite simply unremarkable.
However, I started a new round of test about three months ago (Though that's long enough that I'll have to start again) before my primary daytime job (the one that pays the bills) got extremely busy.
Today marks the passing of the busy period, and I'll hopefully get a week off next week, during which I intend to make a long overdue update
Based on hearsay I expect A-Squared to do much better, though you can be sure I'll report what I find honestly and impartially.
Steve
Thank you for such quick answer! - for now I will probably install some additional soft (like Malwarebytes or Superantispyware) for enhanced protection - I am looking forward new tests results.
For those of you thinking SpyBot is the last word in getting rid of spyware...Sigh...
http://www.mylovelyapps.com/comp/antispyware-test2009.htm
Hey, I want to thank everyone who commented here. I was trying to figure out which software to use on 3 computers, all with different tech-savy users.My laptop,(I'm a CIS student) my desktop(used by the kids and relatives who barely know how to save files) and my husbands laptop for work(he had to be shown how to turn the darned thing on)It sounds like freeware is a possibility for me, I know how to do things manually.Unfortunately, it does sound like I'm going to need to keep paying for Norton (or something like it) on the other two, unless I want to have to ride herd. You have all been most helpful!
Erin in Oregon
Norton has gotten better, by the results of recent Independent Testers. Microsoft Security Essential is as good as Norton or a little better by the same Independent Testing results and it's free...
You can dump Norton too (and say "Good Riddance" in the process).
See http://www.techsupportalert.com/best-free-anti-virus-software.htm
My own personal choice is Avast - but whatever floats your boat :)
Steve
SuperAntiSpyware now has a portable version. Put it on a USB and go. I just used it to cleaning a machine. The other spyware programs I was trying to use were getting blocked by the spyware.
Oops I guess I should have read the post before mine.
SAS has a portable scanner available now :
http://www.superantispyware.com/portablescanner.html
Free for personal use.
I have recently begun using Superantispyware paid but wondered if this program has automatic updates as I have never seen it update automatically. Perhaps no indication is given but I would like to know.Other security programs such as Avast give a can't miss notice that an update has taken place. Thank You
SAS does update automatically, and usually notifies.
Right click the bug icon in the system tray and select "View Control Centre....." , click the updates tab and enable whatever you can.
That should do he trick.
Steve
A-Squared has never helped me..
Awhile back I ran several top named scanners and each one found nothing. I decided to try A-squared free and it found two very nasty Trojans and neither were false-positives, so I am sold on A-squared even though it takes a little longer to update it's two engines...
I also have never had any luck with A2 but their new HIJACK FREE app is a lifesaver. Its basically like a much easier to use version of process explorer (what a mess that software is. The gui is so bad you have no idea what yer looking at or what to do with it. Definitely beta software designed by an engineer for other engineers).
Many new bugs disable the task manager which is a serious roadblock if your trying to clean your computer and you can't even get your AS and AV software to run. But with Hijack free you can shut down processes, services, ports and all kinds of other places where malware hides then you can carry on with the disinfection. Brilliant!
-J
1. Why is SuperAntiSpyware so slow to load and update? It's ridiculous: once selected, the program takes almost a minute to appear on screen, and updating takes minutes to complete. This is in stark contrast to the blazing speed of Malwarebytes. Do other people here find SAS to be slow?
2. SAS skips files over 4 MB when scanning, along with other defaults. Is this safe? Should these default settings be changed?
Thanks.
Responding to post #1...
"Why is SuperAntiSpyware so slow to load and update?"
When is the last time you updated the program version? Several months ago, I too experienced a slow load with SAS. I then updated to the newest program version (as of this email, it is 4.33.1000) and the load time dramatically decreased to about 5 seconds.
"SAS skips files over 4 MB when scanning, along with other defaults. Is this safe? Should these default settings be changed?"
You can easily change these settings by going to the Preference tabs.
Thanks for the tip-off: I checked and sure enough, I have an older version. It seems when you click update on the main page, it only updates the anti-malware definitions, not the program. To update the program, you have to go to the Updates tab > Check for updates now, and while there you can tick "check when application starts." Once updated, the program launched in under 10 seconds, and got new anti-malware definitions fast.
As for the settings, the two I wonder about are "don't scan files over 4 MB" and "don't scan non-executable files"; the program recommends you leave them unchecked, and skipping these file types undoubtedly is why SAS is so fast in scanning. Should they be ticked, though, or is is safe to it alone?
This is my only gripe with SAS. If the engine is old and needs to be updated then SAS should do so automatically just like MWB.
IOW, when you click update, it should determine that there is a new version available, download and install it along with the latest definitions.
-J
Is it a good idea to run both SAS and MBAM at the same time?
No-not if both are running real time protection.It is best to have SAS as your real time and MBAM as a scanner.
i don't use either for real time. just to scan. so if i'm not using them for real time, can i scan with both at the same time? will they catch anything together that running them one after the other would not catch?
Running both is fine but they need to do this separately. Trying to run them both at the same time will actually reduce their effectiveness and is likely to give you system problems as well.
Yes, run them both along with Hitman Pro as on-demand scanners. Once each month I also run A-squared free. A-squared has two engines, so might take around 30 min total to update and finish scanning, but I have found no better scanner for detection and removal of Trojans.
No advantage to running (scanning) both at the same time. However perhaps MC or another can comment more than I can about possible conflict when scanning at the same time. Not sure if this could cause a crash or not.
It seems that Panda Anti-Rootkit doesn't work on Vista, along with Threatfire, Panda Cloud AV, AVG, AdAware, and a whole bunch of other free programs. Thank you, Microsoft!
SuperAntiSpyware even better now!
Release Date Version Product Changes and Enhancements
01/06/2010 4.33.1000 Technology Changes
* Resolved rare crash issues where infections were blocking/redirecting
* Windows 7/Vista Limited User technology enhancements
* Scanning engine enhancements
* Diagnostic system improvements to diagnose new rootkits more efficiently
* 64-bit Users: We will have a PRE-RELEASE available by next week to test the native 64-bit drivers/application. This is not a mixed 32/64 bit application like many other products, but completely 64-bit native.
http://www.superantispyware.com/download.html
I have Vista and SAS keeps stalling in the middle of scans. Are the 2 related?
There could be many reasons for this stalling including an infection. Try downloading Malwarebytes and HitmanPro. Make sure Malwarebytes is updated then scan with both. Please be certain to check the scan results with a third party source like Virus Total to minimize the risk of deleting something which might be a 'false positive'.
http://www.softpedia.com/get/Antivirus/Malwarebytes-Anti-Malware.shtml
http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/Hitman-P...
http://www.virustotal.com/
anonymous - massive poem LOL
superantispyware a good free prog tho, at end of day
CHEERS GIZMO - YOURE THE BEST!
I have been searching for help by googling ratings/reviews best FREE AntiVirus/adware remover/spyware. I went as far as to search "for dummies."
I believe sometime yesterday or the night before I may have visited a site or downloaded something that is causing my browsing to act very badly (yes I surf a lot and yes I DL a lot). If I use IE it has been freezing up, also when I clicked on the link for this forum I got a bizrate page. I had to copy and paste the URL into a new browser window. It happened with another link to, I don't recall what site popped up another "bizrate" type site.
Google Chrome completely shut down on me, everytime I tried to do a search with GC, it said the website is temp down. I tried uninstalling and and reinstalling it, but it still happened. I am now bouncing between IE and Opera.
I have Windows Defender, the quick scan said no problems found. The advanced scan shut down after running for over an hour. Not trying to be paranoid, but a little concerned that (WD) might be "infected" as well.
I do not have an AV program.
So here is my plan.
I will DL Avira and use it faithfully and also DL SAS.
I can not make any promises as to my surfing and DL'ing habits >>> (I know I am a dummy)
My question is do you think that Avira and SAS can help me or do I need to go bigger, better (gulp) not free? I have a very limited income, so I am hoping that the 2 free options will work for me.
Thanks for any and all help, Charlene
Hi Charlene
Sorry to hear about your experience but please view this as a learning event!
Unfortunately, installing security software into an already infected system is not so easy as if it were clean. Also, depending on what it is you've picked up, Avira might struggle to remove it completely.
You might like to look at this link first.
http://www.techsupportalert.com/content/spyware-removal-guide.htm
..... and then this one for after.
http://www.techsupportalert.com/content/safe-computing-under-hour.htm
If you require more dedicated assistance or what you attempt doesn't seem to be working then please register and post in the forum where we can help directly.
http://www.techsupportalert.com/freeware-forum/general-computer-support/
Hi MC and thx for the links. I checked out the 3 links you gave to me. The last one I followed to the letter. (registering)
The first link about system restore. I have had to do that in the past. I dread the idea of doing it and will only do it as a final and last resort. I can't imagine how many blank DVD's and months it would take to do a backup of my systems C\drive (74GB) and E\drive (335GB) They are both at around 20% free space now and have a 1 TB exHD ready to start using. If I do have something OMG awful infecting my system, then I will most likely transfer that onto a disc anyway and reinfect myself.
I started out yesterday morning searching for help, I appreciate finding it here. I don't know if I should've gotten and run SAS first or Avira. I started out with Avira. After it ran for about 2 hrs. my PC shutdown abruptly. Upon starting it up again I began the Avira again. It ran for close to 12 hrs was at 92.9% and locked up, had to reboot again. Now I just DL'ed SAS and am running that as I reply to you. After it finishes I will run Avira again.
In the 92.9% Avira had found 30 detections and 3 warnigs. Considering how much I surf and DL I found these to be very low numbers.
I have not used an AV program for around a year.
Years ago when I first purchased a PC I used I believe it was McAfee or Norton. After that program became obsolete I tried Avast I didn't particularly like it so after maybe 6 mos or so I tried to remove it from my system (add/remove) and I couldn't. I did end up after a few months end up having to do a system restore. The next was AVG well that one was so fussy it considered almost everything I DL'ed a threat to some level. I used that until I was offline for around 6 mos and when I got back online AVG had expired and everytime I tried to do an update the update manager didn't respond.
So for the past 6 months or so I haven't used any AV protection. Now I have the Avira. I am wondering if the comment left by someone about a program called totalvirus(?) if I should get that and scan DL's before I open them or is there something free and better out there? I haven't been surfing or DL'ing for the past 24 hrs (kinda jonesing here) so I don't know if Avira will do such a scan or not. (right click scan zip/rar)
Thanks again for the help and reply.
P.S. I really didn't focus on the 2nd link too much, I will get back to it when I get my head clear of all this crapola.
I agree that system restore is out of the question given the circumstances and as you rightly point out transferring any data now to somewhere else is only likely to take the infection(s) with it.
What we need to achieve here is something to complete its cycle and give you the option of removing what it finds. If one or more of these happens to be a rootkit then you might be on to a loser anyway. Avira is not the best at installing into an already infected system although yours has so it might still be useful later. Your best option is to run through the other suggestions from the removal guide, try then one at a time and then give Avira another run if and when you can manage to remove some of the infections with another tool. I would try Malwarebytes first followed by HitmanPro.
If by following the removal guide things still aren't happening then you could try Norton. Normally we don't recommend commercial software because there isn't any need to but Norton AV is one of the best at installing into an infected system and for your circumstances we need to remain focused on what is the most practical.
Most of today's anti-malware solutions do offer a right click scan facility for files including the excellent a-squared, the free version of which can be used very effectively as a secondary standalone scanner.
Hey MC sure wish I could upload a pic here, to show you the ugly report SAS gave me!
I did notice after the SAS scan that my PC is responding much faster, so maybe there was some repair made. Also when I did a random google search and clicked on the link provided it did go to the site and not a BS site like earlier.
I am at present DL'ing the rescue system, I will run that to see if anything else is still found. Then move onto HITMAN DL and run that and so on and so forth until I have checked and dbl checked my system.
Good thing football is on right now, I don't mind not surfing or DL'ing with that distraction available!
Thanks again for taking time to assist me ~ MissC
My sister also has this virus that I am recently been battling. It is a nasty little thing that redirects almost every search engine. I originally got it cleaned out, or so I thought with CCleaner, HitmanPro and MWAB all running in safe mode of the Vista Laptop. Less then a week later the little turd showed up again.
I am not sure where it has come from but the system was running AVG as it's real time scanner. I came to this site to find a good Free Antivirus and SPyware dection system as I have some very computer illiterate people that I service their computers and if something this nasty made it through AVG it is time to move off.
But I digress, run your scanners if possible in safe mode with network support so they can update etc and that should help a little bit.
Reagrds,
Rob G
You are definitely attacking this the right way so lets hope it works out for you. After you've undertaken these other processes you could try Avira again because your system might be stable enough then to allow it to complete a full scan.
Once you've cleaned out as much as you can with the conventional stuff please also get these two from Softpedia and run them both.
http://www.softpedia.com/get/Antivirus/F-Secure-BlackLight-Rootkit-Detec...
http://www.softpedia.com/get/Antivirus/Sophos-Anti-Rootkit.shtml
Hopefully they won't find much but in any case please don't delete anything but post your results instead. The best place is here in the forum so we can keep track of what's happening.
http://www.techsupportalert.com/freeware-forum/general-computer-support/
Enjoy the football!
I know at the moment I'm not here as often as I would like (only another 3 - 4 weeks to go before I can get back to business here properly).
You may have another option. You have suggested that you have a 1TB external driving "in waiting". You could try disconnecting your internal drives, and install a bare Windows install on to the 1TB drive. Once that's done, install AV and SAS to it.
Finally, reconnect the internal drives and boot, making sure that you boot to the clean install (you may have to change boot priority in your BIOS to be sure of this), and then do a full system AV and malware scan of all drives.
When the scans finishes, shut down, disconnect the 1TB drive and try to boot as normal. Then try to install AV and anti-malware to the old install and run them again. If everything checks out, you can re-format the 1TB drive ready for use.
Steve
PS apologies for posting as Anonymous - I should really learn to check that I am logged in first.
Steve
avira and sas should help. consider not using winDef as your main realtime AV. Use avira, avast, or even mse. also consider malwarebytes as an additional on demand scanner, and sandboxie for when surfing dodgy sites. If using IE, turn off flash player from running automatically, use protected mode, etc. check those suspect downloaded files with something like virustotal, or virustotal uploader, before use, etc
Im just wondering was IObit Security 360 tested with the rest of these? If so how did it fair? Thanks.
All references to Iobit were removed from the site here pending the outcome of legal action by Malwarebytes over Iobit's use of their signatures in it's own database. From what I've read elsewhere, the detection rate of Iobit dropped dramatically after they were forced to remove the contentious signatures. Personally I would choose an alternative.
Bullcrap! IObit 360 finds adware/spyware and even trojans/rootkits that Malwarebytes and SUPERAntiSpyware miss. Do some pornsurfing, run the other 2 first, then run IObit. You'll see.
Post new comment